suandco.com Listed by madliberator Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold concentrated stores of client financial and personal records, using double-extortion tactics that combine encryption with data theft and public leak-site pressure. Against that backdrop, the Spanish tax-law practice suandco.com appeared on a ransomware group’s listing in early August 2024.

Public reporting states that the site was listed by the group known as madliberator on 7 August 2024, with the claim that internal files had been exfiltrated during a ransomware attack. The number of people affected remains unknown, and further technical detail has not been released. For clients and counterparties of a multi-generational Madrid tax practice, even an unverified listing raises concrete questions about the confidentiality of the records they have entrusted to the firm.

What happened

On 7 August 2024, suandco.com was reported as listed by the madliberator ransomware group. The sole concrete assertion attached to that listing is that internal files were exfiltrated in a ransomware attack. No public confirmation of the intrusion method, the volume of data taken, the precise date of the initial compromise, or any ransom demand has been released. The number of individuals whose information may be involved is recorded as unknown. All that is currently established is the group’s claim of exfiltration and the date the listing was noted.

The group behind it: madliberator

Madliberator is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if payment is not made. The group’s public activity consists largely of posting victim names and, in some cases, sample files to increase pressure. Listings are therefore claims by the actors themselves rather than independently verified disclosures. In the present case, madliberator’s listing of suandco.com asserts that internal files were taken; no additional statements by the group about this specific victim have been made public, and the claim has not been corroborated by the firm or by independent forensic reporting.

suandco.com and its sector

According to the firm’s own description, suandco.com traces its origins to a Madrid law office founded in 1951 by Don Francisco Suárez Sotillo, an attorney and tax inspector. It has operated for three generations as one of the earlier Spanish practices specialising in tax law (Derecho Tributario), advising both families and companies. Legal practices of this type routinely hold client identity documents, tax returns, financial statements, correspondence with tax authorities, and related commercial records. Because those materials are both sensitive and long-lived, a breach affecting such a firm can expose clients to identity misuse, targeted fraud, and regulatory complications under European data-protection rules. The listing therefore carries weight beyond the firm itself: it touches the confidentiality expectations of the private individuals and businesses that have relied on the practice for decades.

The information in question

The only data category named in connection with the incident is “internal files exfiltrated in a ransomware attack.” No inventory of file types, no count of records, and no confirmation of whether client personal data, tax filings, or purely administrative material were among the files has been published. Organisations operating in tax and commercial law typically maintain precisely the kinds of records that ransomware groups prize—names, national identification numbers, bank details, tax identifiers, and confidential advice. Until the firm or independent investigators release a verified description, however, the exact contents of any exfiltrated material remain unconfirmed. Readers should treat any subsequent claims of specific document types as unverified unless they originate from an official source.

Why it matters

For individuals and companies that have used suandco.com’s services, the principal risk is the potential exposure of tax and financial information that can be reused for impersonation, fraudulent filings, or social-engineering attacks. Even partial internal files can supply enough context for convincing phishing messages that reference real matters. For the firm, the incident—if the group’s claim proves accurate—raises questions of regulatory notification under the GDPR, possible civil claims, and the practical cost of forensic investigation and client communication. Because the scale remains unknown, the full extent of those consequences cannot yet be measured; the listing itself, however, already places the confidentiality of long-standing client relationships under public scrutiny.

If your data was in this claimed breach

If you are a current or former client of suandco.com, or if you have exchanged tax or financial documents with the firm, treat the listing as a prompt for precautionary steps rather than as confirmed proof that your records were taken. Practical first measures include:

• Review recent account statements and tax correspondence for unexpected activity or new filings made in your name.
• Change passwords on any portals or email accounts that may have been used to communicate with the firm, and enable multi-factor authentication where available.
• Remain alert for phishing messages that reference tax matters, Madrid law firms, or specific past engagements; verify any such contact through a known independent channel.
• Consider placing fraud alerts or credit freezes with the relevant Spanish credit bureaux if you hold significant financial exposure.
• Run a free exposure scan of your email address against known breach corpora to determine whether your details have already appeared in other public dumps.

Public detail on this incident remains limited. Any further official statements from the firm or from Spanish data-protection authorities should be monitored for confirmation of what, if anything, was actually removed.

AICompiled with AI assistance from public sources and published under our editorial standards.